Security Engineer

Summary

Join Wellmark as an experienced Information Security Engineer to architect, deploy, and operate a secure application infrastructure. You will support operational innovation, provide security direction, and deliver applications at scale. This advanced role requires troubleshooting skills, knowledge of architecture and design principles, and the ability to handle disparate applications and data systems. You will oversee vulnerability scanning, certificate management, and other security and compliance efforts. The position offers remote work flexibility and requires up to 5% travel. Wellmark is a mutual insurance company committed to its members' well-being and offers a supportive and innovative work environment.

Requirements

• Bachelor's degree or direct and applicable work experience
• 3+ years of experience working in analysis of server or network controls in any of the following: DevOps, Identity and Access Management (IAM), Windows and Linux Security, Cloud Security, Network and Network Security, Active Directory, Python, AWS, AWS Security Controls and Services
• Knowledge of compliance and regulatory program requirements, such as HIPAA, ISO 27000, NIST, FISMA, and/or SOC standards
• Experience using IAM the following tools: Sailpoint, CyberArk, AWS Secrets Manager, AWS Config
• Strong working knowledge across IT functions (Systems, Network, Databases and/or Application Development, SAST tools, Azure DevOps)
• Strong analytical and problem-solving skills
• A certain degree of creativity, innovation and latitude is required (the ability to think outside the box when faced with challenges)
• High attention to detail while completing tasks and processes
• Ability to prioritize to maximize personal efficiency
• Ability to troubleshoot and interpret user problems and discern appropriate solutions
• Ability to look across multiple systems, applications, and networks to troubleshoot security issues
• Strong compliance and regulatory focused customer service orientation with effective verbal and written communication skills working with technical and nontechnical personnel, with the ability to address all levels of leadership, business, technical, and non-technical staff
• Travel required up to 5%

Responsibilities

• Help architect, deploy, and operate a secure application infrastructure that aligns with business needs
• Support operational innovation and provide security direction to the business to elevate the company’s security posture
• Deliver applications at scale and with resiliency to support business initiatives
• Possess troubleshooting skills, and be knowledgeable about architecture, engineering and design principles and best practices
• Be adept at dealing with disparate applications and data systems to maintain the level of rigor required to adhere to business direction
• Oversee Engineering areas of vulnerability scanning, certificate management, password policy management, data analysis of security monitoring outputs, coordination of remediation vulnerabilities and other daily security and compliance efforts
• Build and maintain the availability of the identity access platforms
• Build and maintain the vulnerability threat and scanning tools
• Evaluate applications in development for potential vulnerabilities to identify security flaws before they are released to production
• Secure business applications and computing environments across public, private or hybrid cloud infrastructures
• Review and analyze vulnerability data to identify security risks to the organization's network, infrastructure, and applications
• Design, implement and improve detection and prevention of vulnerabilities
• Provide expertise and best practices for implementing cloud security and secured code detection and prevention
• Conduct rigorous oversight of security systems and security configuration administration to reduce risk to enterprise systems and accounts
• Oversee the management and remediation of identified security flaws within development platforms
• Build and maintain monitoring, auditing, and reporting frameworks that produce evidence that support security and compliance needs
• Actively monitor, assess and recommend tactical and strategic initiatives based on new and emerging threats posing risk to cloud computing environments
• Develop processes that produce evidence that will support security and compliance requirements
• Track security issues in the same work tracking systems leveraged by the development and operations teams to ensure seamless communication and resolution of issues
• Manage remediation efforts after security assessment findings outline weaknesses requiring attention
• Protect business applications in compliance with privacy, security, business resiliency and compliance frameworks as defined in corporate policies
• Other duties as assigned

Preferred Qualifications

• Python, Azure, RDS Security, AWS Policies, Azure Devops, DevSecOps Federation, SSO, Cyberark, Splunk/Sumo Logic, Sailpoint
• Powershell, Bash scripting, Java programming related to Sailpoint IIQ, RHEL Linux versions 7 and 9, Infrastructure as Code using Terraform and/or CDK, Pipeline programming for ADO, GIT

Benefits

Remote Eligible: You will have the flexibility to work where you are most productive. This position is eligible to work fully remote